Info Security Architect - AI

What matters most

• Secure AI architecture across the lifecycle

  The role defines guidance for data ingestion, training, deployment and inference, plus reference architectures for GenAI, RAG, agents, tool use and enterprise integrations.

• AI-specific threat modeling and validation

  The architect leads threat modeling, risk assessments and design reviews; develops reusable patterns for prompt injection, model manipulation, excessive permissions and data exposure; and works with red teams to test robustness.

• Proportionate governance and controls

  Security requirements must support the AI Policy and AIS Governance Program while aligning with enterprise policies and applicable regulations. The posting emphasizes risk-based controls that allow development and experimentation.

• Detection and response requirements

  The role defines logging, monitoring, detection and response requirements for agent misuse, prompt attacks, unauthorized model access, abnormal inference and sensitive-data exposure.

• Third-party risk and cross-team influence

  The architect assesses AI vendors, models, platforms and services, recommends mitigating controls, and works with governance, analytics, engineering, cloud security and compliance teams across distributed ownership.

Likely challenges to think through

• Keeping guardrails effective without slowing delivery

  Preparation hypothesis: reusable controls may need to reduce manual review without weakening risk management. Prepare an example of a risk-tiered architecture pattern, what could be automated with engineering teams, and what would still warrant review.

• Containing agent permissions and data exposure

  Preparation hypothesis: agents that use tools and enterprise integrations create a trade-off between useful autonomy and tightly bounded access. Prepare to explain how you would model trust boundaries, limit permissions and verify that monitoring can reveal misuse.

• Securing systems with distributed ownership

  Preparation hypothesis: aligning controls across AI, platform, cloud and governance teams may be harder than defining a standard. Prepare an example of how you would communicate a technical risk to different stakeholders, assign control responsibilities and resolve a design trade-off.

Topics to prepare

• AI architecture and lifecycle

  The posting covers AI/ML data ingestion, training, deployment, inference and operational monitoring, including GenAI, RAG and agentic systems. To prepare, sketch a RAG system with an agent and identify the data and trust boundaries at each lifecycle stage.

• AI-specific threats and controls

  The role addresses prompt injection, model manipulation, excessive permissions, data exposure, model inversion, poisoning and evasion. To prepare, make a threat-to-control table for a tool-using agent, noting which controls prevent an attack and which detect it.

• Governance and proportionate risk

  The posting calls for controls aligned with MAPFRE’s AI Policy, AI governance program, enterprise policies and applicable regulations, and names NIST AI RMF and MITRE ATLAS as framework examples. To prepare, map a sample AI risk to a proposed control, an approval decision and the evidence needed to explain that decision.

• Data protection and third-party AI risk

  The role includes sensitive-data protection and assessment of external AI vendors, models, platforms and services; the qualifications mention HIPAA and PCI. To prepare, list the data flows and vendor questions you would examine before approving an enterprise AI integration.

• AI detection and response

  The posting specifies monitoring for agent misuse, prompt attacks, unauthorized model access, abnormal inference activity and sensitive-data exposure. To prepare, outline the events needed to distinguish one such incident from expected use, then state an initial response.

Skills to revise

• Draft a reference security architecture

  The role defines reusable architectures and guardrails for AI agents, tool use, orchestration and enterprise integrations. Practice drawing one architecture with trust boundaries, permissions, data controls and guardrails that engineering teams could integrate or automate.

• Run an AI threat-modeling session

  The posting explicitly assigns leadership of AI-specific threat modeling. Practice walking through a RAG or agent workflow, recording attack paths, affected assets, mitigations and residual risks in a format suitable for a security design review.

• Design prompt safety tests

  Prompt safety testing and collaboration with red teams are stated requirements. Draft a small set of prompt-injection and unauthorized-tool-use test cases, with expected safe behavior and criteria for recording failures.

• Review a cloud AI service

  The qualifications require experience securing enterprise AI platforms or cloud AI services, giving Azure OpenAI, AWS Bedrock, Google Vertex AI and Databricks as examples rather than requiring every one. Practice reviewing the access, data-protection and logging design for one example you know.

• Assess a third-party AI offering

  The role assesses vendor, model, platform and service risks and recommends mitigations. Practice producing a short assessment that states data exposure paths, access concerns, monitoring gaps and conditions for use.

• Communicate a risk-based decision

  The posting calls for technical and non-technical risk communication and leadership across teams with distributed ownership. Practice presenting one AI security design decision in two versions: an engineering-level control rationale and a brief explanation of the risk and trade-off for governance stakeholders.

• Map the AI security lifecycle

  The posting covers data ingestion, training, deployment, inference and monitoring. Prepare a one-page reference architecture showing trust boundaries, sensitive-data flows and proposed controls at each stage.

• Walk through a relevant architecture decision

  If you have a suitable example, prepare a concise walkthrough of an enterprise AI or cloud security design: the risk, options considered, control choices and outcome. Distinguish your own contribution from the team’s.

• Practice a GenAI threat-model exercise

  Sketch a RAG or agent-based system with tool access, then identify prompt injection, model manipulation, excessive permissions and data-exposure paths. Show how you would prioritize mitigations and validate them.

• Draft proportionate guardrails

  Prepare a short example of reusable security requirements for an AI integration, including controls that engineering teams could automate. Explain how you would align them with an AI policy, governance standards and applicable requirements without assuming every control fits every use case.

• Prepare platform and vendor assessment evidence

  The role calls for securing enterprise AI services and assessing third parties. Bring examples, if available, of platform or vendor reviews; otherwise, draft the questions you would ask about data handling, access, model use and contractual controls.

• Outline testing and operational response

  Draft a test-and-monitoring plan for prompt attacks, agent misuse, unauthorized model access, abnormal inference and sensitive-data exposure. Include what a red team would test, what to log and when to escalate.

• Prepare leadership examples and employer questions

  Select examples, if available, of communicating risk to technical and non-technical stakeholders across distributed teams. Ask how MAPFRE divides AI security ownership between cybersecurity and the AI team, and how its AI governance program handles design reviews and exceptions.